From 33bd8eccd5ed3b9e87140103cf63cd7aa02c22e2 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Fri, 20 Oct 2023 04:08:13 +0200 Subject: [PATCH 1/8] Fix missing background behind dismissable banner in web UI (#27479) --- .../mastodon/features/explore/statuses.jsx | 32 ++++++++----------- 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/app/javascript/mastodon/features/explore/statuses.jsx b/app/javascript/mastodon/features/explore/statuses.jsx index f32a4a5368..0d8d212b25 100644 --- a/app/javascript/mastodon/features/explore/statuses.jsx +++ b/app/javascript/mastodon/features/explore/statuses.jsx @@ -45,24 +45,20 @@ class Statuses extends PureComponent { const emptyMessage = ; return ( - <> - - - - - - + } + alwaysPrepend + timelineId='explore' + statusIds={statusIds} + scrollKey='explore-statuses' + hasMore={hasMore} + isLoading={isLoading} + onLoadMore={this.handleLoadMore} + emptyMessage={emptyMessage} + bindToDocument={!multiColumn} + withCounters + /> ); } From 284c719f649e7eb1c62511bd1589a86edaba088d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 20 Oct 2023 10:11:40 +0200 Subject: [PATCH 2/8] New Crowdin Translations (automated) (#27480) Co-authored-by: GitHub Actions --- app/javascript/mastodon/locales/ko.json | 2 +- app/javascript/mastodon/locales/nn.json | 10 +++++----- app/javascript/mastodon/locales/sr.json | 2 +- config/locales/nn.yml | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/app/javascript/mastodon/locales/ko.json b/app/javascript/mastodon/locales/ko.json index f2237d693e..09c95e02cd 100644 --- a/app/javascript/mastodon/locales/ko.json +++ b/app/javascript/mastodon/locales/ko.json @@ -204,7 +204,7 @@ "dismissable_banner.explore_links": "이 소식들은 오늘 소셜 웹에서 가장 많이 공유된 내용들입니다. 새 소식을 더 많은 사람들이 공유할수록 높은 순위가 됩니다.", "dismissable_banner.explore_statuses": "이 게시물들은 오늘 소셜 웹에서 호응을 얻고 있는 게시물들입니다. 부스트와 관심을 받는 새로운 글들이 높은 순위가 됩니다.", "dismissable_banner.explore_tags": "이 해시태그들은 이 서버와 분산화된 네트워크의 다른 서버에서 사람들의 인기를 끌고 있는 것들입니다.", - "dismissable_banner.public_timeline": "이것들은 {domain}에 있는 사람들이 팔로우한 사람들의 최신 게시물들입니다.", + "dismissable_banner.public_timeline": "{domain} 사람들이 팔로우하는 소셜 웹 사람들의 최신 공개 게시물입니다.", "embed.instructions": "아래의 코드를 복사하여 대화를 원하는 곳으로 공유하세요.", "embed.preview": "이렇게 표시됩니다:", "emoji_button.activity": "활동", diff --git a/app/javascript/mastodon/locales/nn.json b/app/javascript/mastodon/locales/nn.json index 0a14ea93a3..8ff390aabb 100644 --- a/app/javascript/mastodon/locales/nn.json +++ b/app/javascript/mastodon/locales/nn.json @@ -153,7 +153,7 @@ "compose_form.publish": "Legg ut", "compose_form.publish_form": "Legg ut", "compose_form.publish_loud": "{publish}!", - "compose_form.save_changes": "Gøym", + "compose_form.save_changes": "Lagre endringar", "compose_form.sensitive.hide": "{count, plural, one {Marker mediet som ømtolig} other {Marker media som ømtolige}}", "compose_form.sensitive.marked": "{count, plural, one {Mediet er markert som ømtolig} other {Media er markerte som ømtolige}}", "compose_form.sensitive.unmarked": "{count, plural, one {Mediet er ikkje markert som ømtolig} other {Media er ikkje markerte som ømtolige}}", @@ -171,7 +171,7 @@ "confirmations.delete_list.confirm": "Slett", "confirmations.delete_list.message": "Er du sikker på at du vil sletta denne lista for alltid?", "confirmations.discard_edit_media.confirm": "Forkast", - "confirmations.discard_edit_media.message": "Du har ulagra endringar i mediaskildringa eller førehandsvisinga. Vil du forkaste dei likevel?", + "confirmations.discard_edit_media.message": "Du har ulagra endringar i mediaskildringa eller førehandsvisinga. Vil du forkasta dei likevel?", "confirmations.domain_block.confirm": "Skjul alt frå domenet", "confirmations.domain_block.message": "Er du heilt, heilt sikker på at du vil skjula heile {domain}? I dei fleste tilfelle er det godt nok og føretrekt med nokre få målretta blokkeringar eller målbindingar. Du kjem ikkje til å sjå innhald frå domenet i fødererte tidsliner eller i varsla dine. Fylgjarane dine frå domenet vert fjerna.", "confirmations.edit.confirm": "Rediger", @@ -285,7 +285,7 @@ "footer.privacy_policy": "Personvernsreglar", "footer.source_code": "Vis kjeldekode", "footer.status": "Status", - "generic.saved": "Gøymt", + "generic.saved": "Lagra", "getting_started.heading": "Kom i gang", "hashtag.column_header.tag_mode.all": "og {additional}", "hashtag.column_header.tag_mode.any": "eller {additional}", @@ -314,7 +314,7 @@ "home.pending_critical_update.link": "Sjå oppdateringar", "home.pending_critical_update.title": "Kritisk sikkerheitsoppdatering er tilgjengeleg!", "home.show_announcements": "Vis kunngjeringar", - "interaction_modal.description.favourite": "Med ein konto på Mastodon kan du favorittmerkja dette innlegget for å visa forfattaren at du set pris på det, og for å lagra det til seinare.", + "interaction_modal.description.favourite": "Med ein konto på Mastodon kan du favorittmerka dette innlegget for å visa forfattaren at du set pris på det, og for å lagra det til seinare.", "interaction_modal.description.follow": "Med ein konto på Mastodon kan du fylgja {name} for å sjå innlegga deira i din heimestraum.", "interaction_modal.description.reblog": "Med ein konto på Mastodon kan du framheva dette innlegget for å dela det med dine eigne fylgjarar.", "interaction_modal.description.reply": "Med ein konto på Mastodon kan du svara på dette innlegget.", @@ -673,7 +673,7 @@ "status.unmute_conversation": "Opphev målbinding av samtalen", "status.unpin": "Løys frå profil", "subscribed_languages.lead": "Kun innlegg på valde språk vil bli dukke opp i heimestraumen din og i listene dine etter denne endringa. For å motta innlegg på alle språk, la vere å velje nokon.", - "subscribed_languages.save": "Gøym", + "subscribed_languages.save": "Lagre endringar", "subscribed_languages.target": "Endre abonnerte språk for {target}", "tabs_bar.home": "Heim", "tabs_bar.notifications": "Varsel", diff --git a/app/javascript/mastodon/locales/sr.json b/app/javascript/mastodon/locales/sr.json index 130b28bc74..ec2c76e8f9 100644 --- a/app/javascript/mastodon/locales/sr.json +++ b/app/javascript/mastodon/locales/sr.json @@ -303,7 +303,7 @@ "hashtag.unfollow": "Отпрати хеш ознаку", "hashtags.and_other": "…и {count, plural, one {још #} few {још #}other {још #}}", "home.actions.go_to_explore": "Погледате шта је у тренду", - "home.actions.go_to_suggestions": "Пронађeте људе које бисте пратили", + "home.actions.go_to_suggestions": "Пронађете људе које бисте пратили", "home.column_settings.basic": "Основна", "home.column_settings.show_reblogs": "Прикажи подржавања", "home.column_settings.show_replies": "Прикажи одговоре", diff --git a/config/locales/nn.yml b/config/locales/nn.yml index 9f34e56216..1c187c1de1 100644 --- a/config/locales/nn.yml +++ b/config/locales/nn.yml @@ -570,7 +570,7 @@ nn: enabled: Skrudd på inbox_url: Overførings-URL pending: Avventer overgangens godkjenning - save_and_enable: Lagr og slå på + save_and_enable: Lagre og slå på setup: Sett opp en overgangsforbindelse signatures_not_enabled: Overgangar fungerer ikkje så lenge sikker- eller kvitlistingsmodus er aktivert status: Status @@ -1280,7 +1280,7 @@ nn: deselect: Vel ingen none: Ingen order_by: Sorter etter - save_changes: Lagr endringar + save_changes: Lagre endringar select_all_matching_items: one: Vel %{count} element som passar til søket ditt. other: Vel %{count} element som passar til søket ditt. From 13688539bc7bfb3ffef86b3fd41b37671861c17f Mon Sep 17 00:00:00 2001 From: Claire Date: Fri, 20 Oct 2023 10:45:46 +0200 Subject: [PATCH 3/8] Fix processing LDSigned activities from actors with unknown public keys (#27474) --- app/lib/activitypub/linked_data_signature.rb | 6 ++-- .../activitypub/linked_data_signature_spec.rb | 34 +++++++++++++++++++ 2 files changed, 38 insertions(+), 2 deletions(-) diff --git a/app/lib/activitypub/linked_data_signature.rb b/app/lib/activitypub/linked_data_signature.rb index ea59879f3b..faea63e8f1 100644 --- a/app/lib/activitypub/linked_data_signature.rb +++ b/app/lib/activitypub/linked_data_signature.rb @@ -18,8 +18,8 @@ class ActivityPub::LinkedDataSignature return unless type == 'RsaSignature2017' - creator = ActivityPub::TagManager.instance.uri_to_actor(creator_uri) - creator ||= ActivityPub::FetchRemoteKeyService.new.call(creator_uri, id: false) + creator = ActivityPub::TagManager.instance.uri_to_actor(creator_uri) + creator = ActivityPub::FetchRemoteKeyService.new.call(creator_uri, id: false) if creator&.public_key.blank? return if creator.nil? @@ -28,6 +28,8 @@ class ActivityPub::LinkedDataSignature to_be_verified = options_hash + document_hash creator if creator.keypair.public_key.verify(OpenSSL::Digest.new('SHA256'), Base64.decode64(signature), to_be_verified) + rescue OpenSSL::PKey::RSAError + false end def sign!(creator, sign_with: nil) diff --git a/spec/lib/activitypub/linked_data_signature_spec.rb b/spec/lib/activitypub/linked_data_signature_spec.rb index d5b713b347..97268eea6d 100644 --- a/spec/lib/activitypub/linked_data_signature_spec.rb +++ b/spec/lib/activitypub/linked_data_signature_spec.rb @@ -34,6 +34,40 @@ RSpec.describe ActivityPub::LinkedDataSignature do end end + context 'when local account record is missing a public key' do + let(:raw_signature) do + { + 'creator' => 'http://example.com/alice', + 'created' => '2017-09-23T20:21:34Z', + } + end + + let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => sign(sender, raw_signature, raw_json)) } + + let(:service_stub) { instance_double(ActivityPub::FetchRemoteKeyService) } + + before do + # Ensure signature is computed with the old key + signature + + # Unset key + old_key = sender.public_key + sender.update!(private_key: '', public_key: '') + + allow(ActivityPub::FetchRemoteKeyService).to receive(:new).and_return(service_stub) + + allow(service_stub).to receive(:call).with('http://example.com/alice', id: false) do + sender.update!(public_key: old_key) + sender + end + end + + it 'fetches key and returns creator' do + expect(subject.verify_actor!).to eq sender + expect(service_stub).to have_received(:call).with('http://example.com/alice', id: false).once + end + end + context 'when signature is missing' do let(:signature) { nil } From ab0fb81479ce16f313419c0b07635e3de29273f9 Mon Sep 17 00:00:00 2001 From: Matt Jankowski Date: Fri, 20 Oct 2023 09:32:16 -0400 Subject: [PATCH 4/8] Configure brakeman to ignore url safe preview card urls (#25883) --- app/helpers/formatting_helper.rb | 4 ++ .../trends/links/_preview_card.html.haml | 2 +- config/brakeman.ignore | 39 ------------------- config/brakeman.yml | 2 + .../links/_preview_card.html.haml_spec.rb | 20 ++++++++++ 5 files changed, 27 insertions(+), 40 deletions(-) delete mode 100644 config/brakeman.ignore create mode 100644 spec/views/admin/trends/links/_preview_card.html.haml_spec.rb diff --git a/app/helpers/formatting_helper.rb b/app/helpers/formatting_helper.rb index 5ab0c8c7ba..7d1423e52d 100644 --- a/app/helpers/formatting_helper.rb +++ b/app/helpers/formatting_helper.rb @@ -9,6 +9,10 @@ module FormattingHelper TextFormatter.new(text, options).to_s end + def url_for_preview_card(preview_card) + preview_card.url + end + def extract_status_plain_text(status) PlainTextFormatter.new(status.text, status.local?).to_s end diff --git a/app/views/admin/trends/links/_preview_card.html.haml b/app/views/admin/trends/links/_preview_card.html.haml index 1ca3483715..ee3774790c 100644 --- a/app/views/admin/trends/links/_preview_card.html.haml +++ b/app/views/admin/trends/links/_preview_card.html.haml @@ -4,7 +4,7 @@ .batch-table__row__content.pending-account .pending-account__header - = link_to preview_card.title, preview_card.url + = link_to preview_card.title, url_for_preview_card(preview_card) %br/ diff --git a/config/brakeman.ignore b/config/brakeman.ignore deleted file mode 100644 index d5c0b94436..0000000000 --- a/config/brakeman.ignore +++ /dev/null @@ -1,39 +0,0 @@ -{ - "ignored_warnings": [ - { - "warning_type": "Cross-Site Scripting", - "warning_code": 4, - "fingerprint": "cd5cfd7f40037fbfa753e494d7129df16e358bfc43ef0da3febafbf4ee1ed3ac", - "check_name": "LinkToHref", - "message": "Potentially unsafe model attribute in `link_to` href", - "file": "app/views/admin/trends/links/_preview_card.html.haml", - "line": 7, - "link": "https://brakemanscanner.org/docs/warning_types/link_to_href", - "code": "link_to((Unresolved Model).new.title, (Unresolved Model).new.url)", - "render_path": [ - { - "type": "template", - "name": "admin/trends/links/index", - "line": 49, - "file": "app/views/admin/trends/links/index.html.haml", - "rendered": { - "name": "admin/trends/links/_preview_card", - "file": "app/views/admin/trends/links/_preview_card.html.haml" - } - } - ], - "location": { - "type": "template", - "template": "admin/trends/links/_preview_card" - }, - "user_input": "(Unresolved Model).new.url", - "confidence": "Weak", - "cwe_id": [ - 79 - ], - "note": "" - } - ], - "updated": "2023-07-12 11:20:51 -0400", - "brakeman_version": "6.0.0" -} diff --git a/config/brakeman.yml b/config/brakeman.yml index 95ebc13865..9ac95c8006 100644 --- a/config/brakeman.yml +++ b/config/brakeman.yml @@ -1,3 +1,5 @@ --- :skip_checks: - CheckPermitAttributes +:url_safe_methods: + - url_for_preview_card diff --git a/spec/views/admin/trends/links/_preview_card.html.haml_spec.rb b/spec/views/admin/trends/links/_preview_card.html.haml_spec.rb new file mode 100644 index 0000000000..82a1dee6d7 --- /dev/null +++ b/spec/views/admin/trends/links/_preview_card.html.haml_spec.rb @@ -0,0 +1,20 @@ +# frozen_string_literal: true + +require 'rails_helper' + +describe 'admin/trends/links/_preview_card.html.haml' do + it 'correctly escapes user supplied url values' do + form = instance_double(ActionView::Helpers::FormHelper, check_box: nil) + trend = PreviewCardTrend.new(allowed: false) + preview_card = Fabricate.build( + :preview_card, + url: 'https://host.example/path?query=